Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,303 results · page 45 of 87
Jun 21, 2024A vulnerability was found in Pear Admin Boot up to 2.0.2 and classified as critical.CVE-2024-6241 · Other software · pearadmin · reported by VulDBMedium 5.3
A vulnerability was found in Pear Admin Boot up to 2.0.2 and classified as critical. This issue affects the function getDictItems of the file /system/dictData/getDictItems/. The manipulation with the input ,user(),1,1 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269375.
- Product
- pear_admin_boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic.CVE-2024-6188 · Other software · Parsec Automation · reported by VulDBMedium 6.9
A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export/pagedefinition. The manipulation of the argument ID leads to direct request. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269159. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- TrackSYS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical.CVE-2024-6187 · Other software · Ruijie · reported by VulDBMedium 5.3
A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects unknown code of the file /view/vpn/autovpn/sub_commit.php. The manipulation of the argument key leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-269158 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024A vulnerability, which was classified as critical, was found in Ruijie RG-UAC 1.0.CVE-2024-6186 · Other software · Ruijie · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Ruijie RG-UAC 1.0. This affects an unknown part of the file /view/userAuthentication/SSO/commit.php. The manipulation of the argument ad_log_name leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269157 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC 1.0.CVE-2024-6185 · Other software · Ruijie · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC 1.0. Affected by this issue is the function get_ip_addr_details of the file /view/dhcp/dhcpConfig/commit.php. The manipulation of the argument ethname leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269156. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024A vulnerability classified as critical was found in Ruijie RG-UAC 1.0.CVE-2024-6184 · Other software · Ruijie · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Ruijie RG-UAC 1.0. Affected by this vulnerability is an unknown functionality of the file /view/systemConfig/reboot/reboot_commit.php. The manipulation of the argument servicename leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269155. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024A vulnerability classified as problematic has been found in EZ-Suite EZ-Partner 5.CVE-2024-6183 · Other software · EZ-Suite · reported by VulDBMedium 6.9
A vulnerability classified as problematic has been found in EZ-Suite EZ-Partner 5. Affected is an unknown function of the component Forgot Password Handler. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotely. VDB-269154 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EZ-Partner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2024A vulnerability, which was classified as problematic, was found in spa-cartcms 1.9.0.6.CVE-2024-6129 · Other software · spa-cart · reported by VulDBMedium 6.3
A vulnerability, which was classified as problematic, was found in spa-cartcms 1.9.0.6. Affected is an unknown function of the file /login of the component Username Handler. The manipulation of the argument email leads to observable behavioral discrepancy. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268896.
- Product
- spa-cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsecureltd.blogspot.comseclists.org
Jun 18, 2024A vulnerability, which was classified as problematic, has been found in spa-cartcms 1.9.0.6.CVE-2024-6128 · Other software · spa-cart · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, has been found in spa-cartcms 1.9.0.6. This issue affects some unknown processing of the file /checkout of the component Checkout Page. The manipulation of the argument quantity with the input -10 leads to enforcement of behavioral workflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268895.
- Product
- spa-cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsecureltd.blogspot.comseclists.org
Jun 17, 2024A vulnerability, which was classified as critical, was found in PHPVibe 11.0.46.CVE-2024-6083 · Websites & servers · Phpvibe · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in PHPVibe 11.0.46. Affected is an unknown function of the file /app/uploading/upload-mp3.php of the component Media Upload Page. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268824. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Phpvibe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2024A vulnerability, which was classified as problematic, has been found in PHPVibe 11.0.46.CVE-2024-6082 · Websites & servers · Phpvibe · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, has been found in PHPVibe 11.0.46. This issue affects some unknown processing of the file functionalities.global.php of the component Global Options Page. The manipulation of the argument site-logo-text leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268823. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Phpvibe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2024A vulnerability classified as critical was found in Intelbras InControl 2.21.56.CVE-2024-6080 · Other software · Intelbras · reported by VulDBHigh 8.5
A vulnerability classified as critical was found in Intelbras InControl 2.21.56. This vulnerability affects unknown code of the component incontrolWebcam Service. The manipulation leads to unquoted search path. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 2.21.58 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure and plans to provide a solution within the next few weeks.
- Product
- InControl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbackend.intelbras.comdownload.cronos.intelbras.com.br
Jun 17, 2024A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic.CVE-2024-6062 · Other software · gpac · reported by VulDBMedium 4.8
A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this issue is the function swf_svg_add_iso_sample of the file src/filters/load_text.c of the component MP4Box. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 31e499d310a48bd17c8b055a0bfe0fe35887a7cd. It is recommended to apply a patch to fix this issue. VDB-268790 is the identifier assigned to this vulnerability.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2024A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic.CVE-2024-6061 · Other software · gpac · reported by VulDBMedium 4.8
A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffin_process of the file src/filters/isoffin_read.c of the component MP4Box. The manipulation leads to infinite loop. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is 20c0f29139a82779b86453ce7f68d0681ec7624c. It is recommended to apply a patch to fix this issue. The identifier VDB-268789 was assigned to this vulnerability.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2024A vulnerability, which was classified as problematic, has been found in Ingenico Estate Manager 2023.CVE-2024-6059 · Other software · Ingenico · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, has been found in Ingenico Estate Manager 2023. This issue affects some unknown processing of the file /emgui/rest/ums/messages of the component News Feed. The manipulation of the argument message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268787. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Estate Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgentle-khaan-c53.notion.sitevuldb.com
Jun 17, 2024A vulnerability classified as problematic has been found in LabVantage LIMS 2017.CVE-2024-6058 · Other software · LabVantage · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in LabVantage LIMS 2017. This affects an unknown part of the file /labvantage/rc?command=page&page=SampleHistoricalList&_iframename=list&__crc=crc_1701669816260. The manipulation of the argument height/width leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268785 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- LIMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgentle-khaan-c53.notion.sitevuldb.com
Jun 16, 2024A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2.CVE-2024-6039 · Other software · Fengoffice · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2. Affected is an unknown function of the component Workspaces. The manipulation of the argument dim leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268752.
- Product
- Feng Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsecureltd.blogspot.comseclists.org
Jun 15, 2024A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-6007 · Other software · Netentsec · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /protocol/iscgwtunnel/deleteiscgwrouteconf.php. The manipulation of the argument messagecontent leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268695. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024A vulnerability classified as problematic has been found in playSMS up to 1.4.7.CVE-2024-5851 · Other software · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in playSMS up to 1.4.7. Affected is an unknown function of the file /index.php?app=main&inc=feature_schedule&op=list of the component SMS Schedule Handler. The manipulation of the argument name/message leads to basic cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.4.8 is able to address this issue. The name of the patch is 7a88920f6b536c6a91512e739bcb4e8adefeed2b. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-267912. NOTE: The code maintainer was contacted early about this disclosure and was eager to prepare a fix as quickly as possible.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024Allow attackers to intercept or falsify data exchanges between the client and the serverCVE-2024-2462 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comMedium 6.8
Allow attackers to intercept or falsify data exchanges between the client and the server
- Product
- FOXMAN-UN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.compublisher.hitachienergy.com
Jun 11, 2024A vulnerability classified as problematic was found in smallweigit Avue up to 3.4.4.CVE-2024-5829 · Other software · smallweigit · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in smallweigit Avue up to 3.4.4. Affected by this vulnerability is an unknown functionality of the component avueUeditor. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-267895. NOTE: The code maintainer explains, that "rich text is no longer maintained".
- Product
- Avue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2024AWP Classifieds: Missing AuthorizationCVE-2024-31350 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AWP Classifieds Team AWP Classifieds.This issue affects AWP Classifieds: from n/a through 4.3.1.
- Product
- AWP Classifieds
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update AWP Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 8, 2024A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-5773 · Other software · Netentsec · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /protocol/firewall/deletemacbind.php. The manipulation of the argument messagecontent leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-267456. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2024A vulnerability, which was classified as critical, has been found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-5772 · Other software · Netentsec · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Netentsec NS-ASG Application Security Gateway 6.3. This issue affects some unknown processing of the file /protocol/iscuser/deleteiscuser.php. The manipulation of the argument messagecontent leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-267455. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2024A vulnerability classified as critical was found in LabVantage LIMS 2017.CVE-2024-5771 · Other software · LabVantage · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in LabVantage LIMS 2017. This vulnerability affects unknown code of the file /labvantage/rc?command=page&page=SampleList&_iframename=list of the component POST Request Handler. The manipulation of the argument param1 leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-267454 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- LIMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgentle-khaan-c53.notion.sitevuldb.com
Jun 8, 2024A vulnerability was found in Likeshop up to 2.5.7 and classified as problematic.CVE-2024-5766 · Other software · Likeshop · reported by VulDBMedium 5.1
A vulnerability was found in Likeshop up to 2.5.7 and classified as problematic. This issue affects some unknown processing of the file /admin of the component Merchandise Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-267449 was assigned to this vulnerability.
- Product
- Likeshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2024A vulnerability, which was classified as critical, has been found in Chanjet Smooth T+system 3.5.CVE-2024-5653 · Other software · Chanjet · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Chanjet Smooth T+system 3.5. This issue affects some unknown processing of the file /tplus/UFAQD/keyEdit.aspx. The manipulation of the argument KeyID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-267185 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smooth T+system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2024A vulnerability, which was classified as critical, has been found in bwoodsend rockhopper up to 0.1.2.CVE-2022-4969 · Other software · bwoodsend · reported by VulDBMedium 4.8
A vulnerability, which was classified as critical, has been found in bwoodsend rockhopper up to 0.1.2. Affected by this issue is the function count_rows of the file rockhopper/src/ragged_array.c of the component Binary Parser. The manipulation of the argument raw leads to buffer overflow. Local access is required to approach this attack. Upgrading to version 0.2.0 is able to address this issue. The name of the patch is 1a15fad5e06ae693eb9b8908363d2c8ef455104e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-266312.
- Product
- rockhopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2024A vulnerability, which was classified as problematic, has been found in oretnom23 Online Car Wash Booking System 1.0.CVE-2024-5385 · Other software · oretnom23 · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, has been found in oretnom23 Online Car Wash Booking System 1.0. This issue affects some unknown processing of the file /admin/?page=user/list. The manipulation of the argument First Name/Last Name with the input <script>confirm (document.cookie)</script> leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-266303.
- Product
- Online Car Wash Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2024A vulnerability classified as problematic has been found in lakernote EasyAdmin up to 20240324.CVE-2024-5383 · Other software · lakernote · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in lakernote EasyAdmin up to 20240324. This affects an unknown part of the file /sys/file/upload. The manipulation of the argument file leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 9c8a836ace17a93c45e5ad52a2340788b7795030. It is recommended to apply a patch to fix this issue. The identifier VDB-266301 was assigned to this vulnerability.
- Product
- EasyAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2024A vulnerability classified as problematic has been found in jsy-1 short-url 1.0.0.CVE-2024-5380 · Other software · jsy-1 · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in jsy-1 short-url 1.0.0. Affected is an unknown function of the file admin.php. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is 35c790897d6979392bc6f60707fc32da13a98b63. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-266292.
- Product
- short-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2024A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1.CVE-2024-5356 · Other software · anji-plus · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1. Affected is an unknown function of the file /dataSet/testTransform;swagger-ui. The manipulation of the argument dynSentence leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266268.
- Product
- AJ-Report
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2024A vulnerability, which was classified as critical, has been found in anji-plus AJ-Report up to 1.4.1.CVE-2024-5355 · Other software · anji-plus · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in anji-plus AJ-Report up to 1.4.1. This issue affects the function IGroovyHandler. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266267.
- Product
- AJ-Report
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2024A vulnerability classified as problematic was found in anji-plus AJ-Report up to 1.4.1.CVE-2024-5354 · Other software · anji-plus · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in anji-plus AJ-Report up to 1.4.1. This vulnerability affects unknown code of the file /reportShare/detailByCode. The manipulation of the argument shareToken leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-266266 is the identifier assigned to this vulnerability.
- Product
- AJ-Report
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2024A vulnerability classified as critical has been found in anji-plus AJ-Report up to 1.4.1.CVE-2024-5353 · Other software · anji-plus · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in anji-plus AJ-Report up to 1.4.1. This affects the function decompress of the component ZIP File Handler. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266265 was assigned to this vulnerability.
- Product
- AJ-Report
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2024A vulnerability was found in Ruijie RG-UAC up to 20240516 and classified as critical.CVE-2024-5337 · Other software · Ruijie · reported by VulDBMedium 5.1
A vulnerability was found in Ruijie RG-UAC up to 20240516 and classified as critical. This issue affects some unknown processing of the file /view/systemConfig/sys_user/user_commit.php. The manipulation of the argument email2/user_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266243. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2024A vulnerability has been found in Ruijie RG-UAC up to 20240516 and classified as critical.CVE-2024-5336 · Other software · Ruijie · reported by VulDBMedium 5.1
A vulnerability has been found in Ruijie RG-UAC up to 20240516 and classified as critical. This vulnerability affects the function addVlan of the file /view/networkConfig/vlan/vlan_add_commit.php. The manipulation of the argument phyport leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-266242 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2024A vulnerability classified as problematic has been found in JFinalCMS up to 20221020.CVE-2024-5310 · Other software · Heyewei · reported by VulDBMedium 5.1
A vulnerability classified as problematic has been found in JFinalCMS up to 20221020. This affects an unknown part of the file /admin/content. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266121 was assigned to this vulnerability.
- Product
- Jfinalcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2024A vulnerability was found in FastCMS up to 0.1.5 and classified as problematic.CVE-2023-1111 · Other software · Xjd2020 · reported by VulDBMedium 5.1
A vulnerability was found in FastCMS up to 0.1.5 and classified as problematic. Affected by this issue is some unknown functionality of the component New Article Tab. The manipulation of the argument Title leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-266126 is the identifier assigned to this vulnerability.
- Product
- Fastcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2024A vulnerability, which was classified as problematic, has been found in xuliangzhan vxe-table up to 3.7.9.CVE-2023-1001 · Other software · xuliangzhan · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in xuliangzhan vxe-table up to 3.7.9. This issue affects the function export of the file packages/textarea/src/textarea.js of the component vxe-textarea. The manipulation of the argument inputValue leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.7.10 is able to address this issue. The patch is named d70b0e089740b65a22c89c106ebc4627ac48a22d. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-266123.
- Product
- vxe-table
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2024A vulnerability has been found in EnvaySoft FleetCart up to 4.1.1 and classified as problematic.CVE-2024-5230 · Other software · EnvaySoft · reported by VulDBMedium 6.9
A vulnerability has been found in EnvaySoft FleetCart up to 4.1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument razorpayKeyId leads to information disclosure. The attack can be launched remotely. It is recommended to upgrade the affected component. The identifier VDB-265981 was assigned to this vulnerability.
- Product
- FleetCart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2024A vulnerability classified as critical has been found in Arris VAP2500 08.50.CVE-2024-5196 · Other software · Arris · reported by VulDBMedium 5.1
A vulnerability classified as critical has been found in Arris VAP2500 08.50. This affects an unknown part of the file /tools_command.php. The manipulation of the argument cmb_header/txt_command leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265833 was assigned to this vulnerability.
- Product
- VAP2500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2024In the Linux kernel, the following vulnerability has been resolved: riscv: Flush current cpu icache before other cpus On SiFive Unmatched, I recently fell ontCVE-2021-47414 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: riscv: Flush current cpu icache before other cpus On SiFive Unmatched, I recently fell onto the following BUG when booting: [ 0.000000] ftrace: allocating 36610 entries in 144 pages [ 0.000000] Oops - illegal instruction [#1] [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.13.1+ #5 [ 0.000000] Hardware name: SiFive HiFive Unmatched A00 (DT) [ 0.000000] epc : riscv_cpuid_to_hartid_mask+0x6/0xae [ 0.000000] ra : __sbi_rfence_v02+0xc8/0x10a [ 0.000000] epc : ffffffff80007240 ra : ffffffff80009964 sp : ffffffff81803e10 [ 0.000000] gp : ffffffff81a1ea70 tp : ffffffff8180f500 t0 : ffffffe07fe30000 [ 0.000000] t1 : 0000000000000004 t2 : 0000000000000000 s0 : ffffffff81803e60 [ 0.000000] s1 : 0000000000000000 a0 : ffffffff81a22238 a1 : ffffffff81803e10 [ 0.000000] a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000 [ 0.000000] a5 : 0000000000000000 a6 : ffffffff8000989c a7 : 0000000052464e43 [ 0.000000] s2 : ffffffff81a220c8 s3 : 0000000000000000 s4 : 0000000000000000 [ 0.000000] s5 : 0000000000000000 s6 : 00000002000
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 18, 2024A vulnerability classified as problematic was found in Hipcam Device up to 20240511.CVE-2024-5096 · Other software · Hipcam · reported by VulDBMedium 6.9
A vulnerability classified as problematic was found in Hipcam Device up to 20240511. This vulnerability affects unknown code of the file /log/wifi.mac of the component MAC Address Handler. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-265078 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Device
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsecfish.notion.sitevuldb.com
May 18, 2024A vulnerability classified as problematic has been found in Victor Zsviot Camera 8.26.31.CVE-2024-5095 · Other software · Victor · reported by VulDBHigh 7.1
A vulnerability classified as problematic has been found in Victor Zsviot Camera 8.26.31. This affects an unknown part of the component MQTT Packet Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265077 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Zsviot Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2024A vulnerability, which was classified as critical, was found in Wangshen SecGate 3600 up to 20240516.CVE-2024-5050 · Other software · Wangshen · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Wangshen SecGate 3600 up to 20240516. This affects an unknown part of the file /?g=log_import_save. The manipulation of the argument reqfile leads to unrestricted upload. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-264747.
- Product
- SecGate 3600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2024A vulnerability, which was classified as critical, has been found in Codezips E-Commerce Site 1.0.CVE-2024-5049 · Websites & servers · Codezips · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Codezips E-Commerce Site 1.0. Affected by this issue is some unknown functionality of the file admin/editproduct.php. The manipulation of the argument profilepic leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-264746 is the identifier assigned to this vulnerability.
- Product
- E-Commerce Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2024A vulnerability was found in Emlog Pro 2.3.4 and classified as critical.CVE-2024-5043 · Other software · emlog_pro_project · reported by VulDBMedium 5.1
A vulnerability was found in Emlog Pro 2.3.4 and classified as critical. Affected by this issue is some unknown functionality of the file admin/setting.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264740. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- emlog_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2024** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000-40 V31R02B1413C and classified as critical.CVE-2024-4965 · Network & remote access · D-Link · reported by VulDBMedium 5.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000-40 V31R02B1413C and classified as critical. This issue affects some unknown processing of the file /useratte/resmanage.php. The manipulation of the argument load leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264533 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DAR-7000-40
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
May 16, 2024** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-7000-40 V31R02B1413C and classified as critical.CVE-2024-4964 · Network & remote access · D-Link · reported by VulDBMedium 5.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-7000-40 V31R02B1413C and classified as critical. This vulnerability affects unknown code of the file /firewall/urlblist.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264532. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DAR-7000-40
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.